Interruptor 0.2.0
Interruptor is now multiplatform, and support tracing for followings combinations :
- linux (or android)/arm64
- linux (or android)/x64
Add x64 supports and extend the parsing of syscall args.
Kernel structures involved into syscall API will be published into separate repository:
https://github.com/FrenchYeti/frida-systruct
🔥 Improvements :
- Add x64 support for Linux syscalls tracing
✅ Supported:
- linux / x64
- Close to 100% of coverage for Flag/Bitmap textual decomposition
- Add a way to define structures for complex arguments, to parse and dump it
- Internals : add a callback to execute code only when the device is virtual
- Parsing of syscall args (near of 100% for primitive types) : ORed flags, mode, descriptors, ..
- Start to retrieve name of error code
- More than 950 constants from Kernel supported
- Implement all descriptors : fd, dfd, wd, sockfd, msqd, ..
- API to use constant from Kernel API inside hooks, including error code
- Follow Threads
- Module filtering by name, by regexp, by properties
- System call filtering by name, by regexp, by properties
- Thread coloring
- Android/Arm64 syscalls according to AOSP
- Include deprecated syscalls/flags from linux kernel 2.x -> 5.x
- SVC hooking
- Dynamic loading
- Callback function when start() happens
📆 Partially supported:
- socket, ...
- Signals
- Error code retrieving / returned value parsing
- Contextual args hint : exploring cmd/opts as in prctl()
- Coverage
🛰️ Not supported:
- HVC, SMC, ...
- follow fork